linux-kernel - Re: [patch] vga_switcheroo: comparing too few characters in strncmp()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 06 Jan 2011 23:07:22 -0700
From:	Mailing Lists <listsm@...oo.ca>
To:	Alexey Dobriyan <adobriyan@...il.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: [patch] vga_switcheroo: comparing too few characters in
 strncmp()

On Fri, 2011-01-07 at 07:30 +0200, Alexey Dobriyan wrote:
> On Fri, Jan 07, 2011 at 08:12:27AM +0300, Dan Carpenter wrote:
> > This is a copy-and-paste bug.  We should be comparing 4 characters here
> > instead of 3.
> 
> > --- a/drivers/gpu/vga/vga_switcheroo.c
> > +++ b/drivers/gpu/vga/vga_switcheroo.c
> > @@ -346,11 +346,11 @@ vga_switcheroo_debugfs_write(struct file *filp, const char __user *ubuf,
> >  	if (strncmp(usercmd, "DIS", 3) == 0)
> >  		client_id = VGA_SWITCHEROO_DIS;
> >  
> > -	if (strncmp(usercmd, "MIGD", 3) == 0) {
> > +	if (strncmp(usercmd, "MIGD", 4) == 0) {
> >  		just_mux = true;
> >  		client_id = VGA_SWITCHEROO_IGD;
> >  	}
> > -	if (strncmp(usercmd, "MDIS", 3) == 0) {
> > +	if (strncmp(usercmd, "MDIS", 4) == 0) {
> 
> How about you NUL-terminate, and use strcmp().

Userspace data? How to guarantee NULL terminated string at runtime? 

Still, the string constants being compared against are already NULL
terminated, so he could use strcmp as is.

Also, strcmp() would discard user strings that start with a matching
substring ("DIS", "DISK", "DISH", "DISINTERESTED" would all set
client_id to VGA_SWITCHEROO_DIS, using strncmp(), but strcmp() would
only match "DIS").

> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/